dronecan: SocketCAN driver check size before copying

Avoids memory corruption if we get packets to big
PX4 · May 17, 2024 · ebfa532 · ebfa532
1 parent 470bea9
commit ebfa532
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/drivers/uavcan/uavcan_drivers/socketcan/driver/src/socketcan.cpp b/src/drivers/uavcan/uavcan_drivers/socketcan/driver/src/socketcan.cpp
@@ -218,12 +218,22 @@ uavcan::int16_t CanIface::receive(uavcan::CanFrame &out_frame, uavcan::Monotonic
 	if (_can_fd) {
 		struct canfd_frame *recv_frame = (struct canfd_frame *)&_recv_frame;
 		out_frame.id = recv_frame->can_id;
+
+		if (recv_frame->len > CANFD_MAX_DLEN) {
+			return -EFAULT;
+		}
+
 		out_frame.dlc = recv_frame->len;
 		memcpy(out_frame.data, &recv_frame->data, recv_frame->len);
 
 	} else {
 		struct can_frame *recv_frame = (struct can_frame *)&_recv_frame;
 		out_frame.id = recv_frame->can_id;
+
+		if (recv_frame->can_dlc > CAN_MAX_DLEN) {
+			return -EFAULT;
+		}
+
 		out_frame.dlc = recv_frame->can_dlc;
 		memcpy(out_frame.data, &recv_frame->data, recv_frame->can_dlc);
 	}